I would think that the InMemoryOrderModuleList entry (and thus the Flink
pointer) was located 20 bytes (0x14) down...below an array of eight
bytes + an array of three pointers. So why loading [eax+0x1c] into esi ?